One front in the civil war in Syria has gone unreported in the press -- the cyber front. Strategy Page is reporting that cyberspace has become part of the battlefield in Syria.  Strategy Page reports: [I]t was recently discovered that someone was targeting pro-rebel websites and individuals outside of Syria. The attack came in the form of phony email addressed to a specific individual and made to appear it was from another rebel sympathizer or activist that the recipient knew. There was a file attached which, when opened, secretly installed monitoring software. Thus the infected computer could be secretly monitored [...]

In the July 19, 2012 edition of The Wall Street Journal, President Obama wrote about cybersecurity. The President wrote: ... foreign governments, criminal syndicates and lone individuals are probing our financial, energy and public safety systems every day. Last year, a water plant in Texas disconnected its control system from the Internet after a hacker posted pictures of the facility's internal controls. More recently, hackers penetrated the networks of companies that operate our natural-gas pipelines. Computer systems in critical sectors of our economy—including the nuclear and chemical industries—are being increasingly targeted. He observed: Nuclear power plants must have fences and [...]

In research reported last year in Kaspersky's threatpost, Aaron Higbee, the Chief Technology Officer at Intrepidus Group, stated that 70% to 80% of employees are fooled into taking compromising actions when they receive test spearphishing emails. Spearphishing is a scheme in which targeted emails are sent to individuals to deceive the recipient into taking compromising actions, such as visiting a malicious website, disclosing sensitive information or installing malware.  You can see a demonstration of spearphishing at Spearphishing - The Movie. The Kaspersky posting contains two specific suggestions.  First, train your employees to spot and avoid spearphishing emails.  Second, use email authentication.  At Iconix, [...]

The International Business Times recently reported on the ways cybercriminals are defeating corporate IT security. First, the new malware being used by attackers is harder to detect. Citing IDC research, the article states, "traditional forms of computer security, including antivirus software and firewalls, are only effective against 30 to 50 percent of the malware found today." Second, attackers are becoming far more effective in delivering malware into the enterprise through the use of spearphishing. Instead of using crudely crafted messages that are sent to large numbers of people in hopes that a few people will be deceived, in spearphishing the attacker gathers [...]

Yesterday (July 5, 2102), the United States Court of Appeals for the First Circuit issued its much anticipated ruling in Patco Construction Company vs. People's United Bank d.b.a. Ocean Bank.  The court summarized the facts as follows: Over seven days in May 2009, Ocean Bank, a southern Maine community bank, authorized six apparently fraudulent withdrawals, totaling $588,851.26, from an account held by Patco Construction Company, after the perpetrators correctly supplied Patco's customized answers to security questions. Although the bank's security system flagged each of these transactions as unusually "high-risk" because they were inconsistent with the timing, value, and geographic location [...]

McAfee and Guardian Analytics have released a new whitepaper entitled, Dissecting Operation High Roller.  In the whitepaper, they describe a massive global attack that is stealing tens of millions of dollars banks, institutions and wealthy individuals. Unlike standard SpyEye and Zeus attacks that typically feature live (manual) interventions, we have discovered at least a dozen groups now using server-side components and heavy automation. The fraudsters’ objective in these attacks is to siphon large amounts from high balance accounts, hence the name chosen for this research: Operation High Roller. With no human participation required, each attack moves quickly and scales neatly. [...]

On June 14, 2012, Mark Weatherford, DHS's deputy under secretary for cybersecurity, provided at least the third formal cybersecurity presentation to the United States Senate.  The demonstration was part of the Obama Administration's efforts to pass cybersecurity slated to come to the Senate floor in the next three weeks.  This demonstration again focused on a spear phishing attack against the Homeland Security Department. The demonstration reflected the reality of the recent attack against the U.S. Natural Gas Pipeline infrastracture. Secretary Weatherford said the purpose of the demonstration was not to scare Senators and staff, but to enlighten them about how easy it [...]

This week DigitalBond, a firm that specializes in security for Industrial Control Systems (ICS), reported that it had been the victim of a spearphishing cyberattack.  Demonstrating the clever personalization that social engineering requires, DigitalBond reported: It’s a bit concerning that a company whose sole focus is securing industrial control systems should be spear phished.  The attacker clearly went to enough trouble to try to understand ICS security lingo to get the employee to open the link, and had to compromise a DNS server. This is the spearphishing email: Security Week  reports that this attack was part of a series of [...]

In a new video, American Banker discusses the ease with which hackers can deceive email recipients. In the video, the reporters discuss how a security expert crafted an email from one reporter to the other.  The recipient, being deceived into believing that the hacker was a colleague, opened the fake email.  Why?  Because it is impossible to easily determine that the fake email was fake. American Banker concludes: Social engineering attacks — also known as phishing and spear-phishing — are on the rise against banks and their corporate customers. The stakes are high and rising for both. Social engineering deceives users into becoming [...]